CVE-2026-45669
Description
Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv="refresh"> tag. The destination URL is only sanitized by replacing " with %22, leaving <, >, &, and ' unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content="…" attribute and inject arbitrary HTML/JavaScript that executes under the application's origin. This issue has been patched in versions 3.21.6 and 4.4.6.
How to fix
- nuxt nuxt3.21.6, 4.4.6 or later
- nuxt3.21.6, 4.4.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuxt nuxt | 3.4.3 ≤ v < 3.21.6, 4.0.0 ≤ v < 4.4.6 | 3.21.6, 4.4.6 |
| nuxtnpm | 3.4.3 ≤ v < 3.21.6, 4.0.0-alpha.1 ≤ v < 4.4.6 | 3.21.6, 4.4.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.